IT and digital tenders in the UK: a guide for suppliers

IT opportunities are harder to find than construction opportunities. Buyers file digital needs under generic wording such as "professional services" or "technology support", the vocabulary changes from one authority to the next, and a large share of the money never reaches an open notice at all because it is spent through central frameworks. This guide covers what UK public buyers actually buy, how these contracts are structured, and which filters keep you from missing them.

What UK public buyers buy

A council, an NHS trust, a university or a government department buys, separately or inside one framework:

• Hardware: end-user devices, servers, networking, telephony, print, interactive displays for schools.
• Software and licences: line-of-business applications (finance, HR, revenues and benefits, housing management, case management, student records), productivity suites, publisher licences, support and upgrades.
• Development: business applications, citizen-facing portals, websites, mobile apps, APIs and data exchange.
• Managed services: monitoring, server and network administration, device fleet management, service desk from first to third line, application support.
• Hosting and cloud: application hosting, backup, disaster recovery, public cloud migration and management.
• Cyber security: audits, penetration testing, security monitoring, compliance and remediation.
• Data and artificial intelligence: open data, business intelligence, automation and AI pilots.
• Related services: client-side advisory work, change management, staff training.

The CPV codes to know

Filtering by CPV code is the only reliable way to cover a sector whose wording is unstable. CPV codes are mandatory on notices published under the Procurement Act 2023 and on Irish and EU notices, which makes them the one filter that works across all portals.

Then go down to group or class level to refine. See Choosing your CPV codes. On Find a Tender and Contracts Finder there is no descriptor taxonomy to fall back on, so pair the CPV filter with a short synonym list.

Applicable thresholds

IT falls under goods and services contracts. UK thresholds are inclusive of VAT, unlike the EU thresholds that apply in Ireland.

These figures apply from 1 January 2026 (verified 2026-09-05). Value is assessed over the full term, extensions included: a four-year managed services framework passes the threshold quickly, even for a small authority. In Ireland the EU thresholds apply, at €140,000 for central government and €216,000 for other contracting authorities, excluding VAT, with national advertising on eTenders from €50,000.

The dominant contract structures

Digital needs are rarely bought as a single fixed contract.

• The framework agreement is the norm. It sets prices and terms without ordering anything immediately, and usually runs up to four years.
• A call-off by direct award draws down that framework as needs arise, sometimes with an indicative maximum.
• A multi-supplier framework appoints several providers and then reopens competition for each project through a call-off contract. Being appointed guarantees no revenue at all: the real contest happens at each mini-competition.
• A dynamic market, which replaced the dynamic purchasing system under the Procurement Act 2023, stays open for new suppliers throughout its life, so a late applicant is not shut out for four years.
• A phased contract suits staged projects: a firm phase for discovery and scoping, optional phases for build and rollout.
• Lots often separate software, integration, hosting and support, which opens the door to specialists.

Crown Commercial Service and central buying

Many UK public buyers order through the Crown Commercial Service or a public buying organisation such as ESPO, YPO, NEPO or the Scottish Government's national frameworks, and in health through NHS Supply Chain and the Atamis health family. G-Cloud remains the main route for cloud services and cloud support, and there are separate agreements for digital specialists, technology products and networks. A buyer calling off from one of these agreements has already met its competition obligations, so no notice is published and the work is out of reach unless you are on the agreement.

Two consequences. First, watch the competitions that create and refresh those agreements: they are advertised like any other contract and cover several years. Second, do not conclude from silence on Find a Tender that a buyer is not spending; it may be calling off a framework.

Recurring technical requirements

The specification of a digital contract almost always contains the same requirements, better prepared once and reused:

• personal data protection: processor obligations under UK GDPR and the Data Protection Act 2018, data location, international transfers and backups;
• security: Cyber Essentials or Cyber Essentials Plus, often mandatory, ISO 27001, access management, logging, backups, continuity plans and vulnerability remediation commitments, plus the Data Security and Protection Toolkit for NHS data;
• digital accessibility: WCAG 2.2 AA and the Public Sector Bodies (Websites and Mobile Applications) Accessibility Regulations 2018 for public-facing interfaces;
• service levels: guaranteed response and restoration times, support hours, service credits;
• exit and interoperability: export formats, documentation, data handover at contract end, ownership of source code and intellectual property, and open standards under the Technology Code of Practice;
• transparency and resilience obligations that the Procurement Act 2023 attaches to contracts above a value set in the tender documents.

Innovation, pre-market engagement and sourcing

The Procurement Act 2023 gives buyers an explicit route to talk to the market before a procedure starts: preliminary market engagement, announced through a preliminary market engagement notice. It is lawful as long as it does not put any supplier at an unfair advantage, and it is where innovative work is genuinely won. Planned procurement notices published up to a year in advance signal needs in preparation, and pipeline notices from larger authorities set out what is coming over the next eighteen months.

IT checklist

• Monitoring profile defined on CPV 72 and 48, widened to 30, 64 and 79 depending on your offer.
• Synonym clusters ready for literal portal searches: managed service, service desk, hosting, application support, systems integration, line-of-business.
• Framework and dynamic market refresh dates tracked, G-Cloud included.
• Position decided on Crown Commercial Service agreements and the buying organisations in your sector.
• Reusable answers on UK GDPR, Cyber Essentials, accessibility, exit and service levels.
• References sorted by need type, with volumes and duration.
• Day-rate pricing model by grade, consistent with the rate card requested.

Scoutee tracks these digital notices, scattered across Find a Tender, Contracts Finder, the devolved portals and buyers' own e-sourcing platforms.